Pre-investor-demo AI security check

What middleBrick covers

  • Pre-investor-demo AI endpoint security validation
  • 18 adversarial AI security probes across scan tiers
  • OpenAPI 3.0/3.1 and Swagger 2.0 with $ref resolution
  • Authenticated scanning with domain verification gate
  • Mapped findings to OWASP API Top 10, PCI-DSS 4.0, SOC 2
  • CI/CD integration via GitHub Action and CLI output

Pre-investor demo AI security check

An investor demo showcases live features, integrations, and data views. If the API serving the demo exposes AI-related endpoints without proper controls, an attacker can extract system prompts, alter instructions, or trigger data exfiltration. A pre-investor-demo check validates the AI security posture of these endpoints before the demo is shared, reducing the risk of public exposure of internal logic or sensitive training details.

What teams get wrong when skipping this check

Teams often focus on functionality and uptime, deferring security until a later phase. Without a pre-demo review, common AI security mistakes appear in production-facing endpoints, including missing guardrails for prompt injection, token smuggling, and roleplay jailbreaks. These gaps can lead to system prompt leakage, unauthorized tool use, and indirect prompt injection through third-party data, which are difficult to contain after investor exposure.

A good workflow for AI security before demoing

Integrate security checks into the staging pipeline before any external access. Run a targeted scan against the demo environment using a standard profile, then a deep scan on endpoints that handle user input or model instructions. Review findings for prompt injection vectors, data exfiltration risks, and exposed internal instructions. Fix high-risk issues, re-scan to confirm resolution, and repeat this cycle on every significant change.

Example workflow using the CLI:

middlebrick scan https://staging.example.com --profile deep --output json

Use the JSON output to feed a dashboard or ticketing system, and block merges in CI when critical findings remain unresolved.

What middleBrick covers out of the box

middleBrick is a black-box API security scanner that maps findings to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II controls. For AI security, it runs 18 adversarial probes across three scan tiers, focusing on system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, encoding bypasses, translation-embedded injection, few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool abuse, nested instruction injection, and PII extraction.

The scanner supports OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, comparing spec definitions against runtime behavior to detect undefined security schemes or unexpected sensitive field exposure. Authenticated scanning is available with Bearer, API key, Basic auth, and cookies, protected by domain verification to ensure only the domain owner can run credentialed scans.

Next steps and limitations

Use middleBrick as a detection and reporting tool; it does not fix, patch, or block findings. It does not perform active SQL injection or command injection testing, does not detect business logic vulnerabilities, and does not replace a human pentester for high-stakes audits. Continuous monitoring and scheduled rescans can highlight new findings and score drift over time, but remediation requires manual investigation and code changes aligned with your risk tolerance.

Frequently Asked Questions

Can I run a pre-investor-demo scan with my API key?
Yes, authenticated scanning is available on Starter and higher. The domain verification gate ensures only the domain owner can scan with credentials.
Which AI security probes are included in the Deep profile?
The Deep profile includes all 18 adversarial probes covering prompt injection, jailbreaks, data exfiltration attempts, encoding bypasses, and PII extraction across multi-turn and indirect injection scenarios.
Does middleBrick provide a compliance report for SOC 2 or PCI-DSS?
Findings map to SOC 2 Type II and PCI-DSS 4.0 controls. The dashboard and reports help you support audit evidence, but the tool does not certify compliance.
How often should I rescan before investor meetings?
Run scans at least once before sharing any demo environment. For ongoing assurance, schedule weekly or monthly rescans to catch new issues introduced by feature changes.
Can I integrate scanning into my CI/CD pipeline?
Yes, the GitHub Action can fail the build when the score drops below your chosen threshold, enforcing security gates before deployment.